Client VPN's to Meraki MX

[TBee]

I have quoted a Meraki MX SD-WAN solution to a customer, for 1 remote site and one central site.

                1 x MX67 at the remote site

                2 x MX105 at the core site. (HA Pair)

The customer is planning on adding more sites on to the SD-WAN over the coming year, total maximum of 7-8 remote sites.

The customer would also like to connect up to 100 Client VPN (RAS) users to the MX105, the Client devices be approximately 85 Windows 11 devices and 15 Mac. What would be a reliable low cost or free option, they are currently using a free RAS client to a FortiGate. Would it be to use the VPN client inherent in the OS (Windows 11 and Mac) or Cisco AnyConnect, or would the AnyConnect just add unnecessary cost?

[alemabrahao]

You can use a virtual Linux machine with Strongswan.

[GreenMan]

I think AnyConnect (or Secure Client, as it now is) working with MX would potentially be a great solution here:   more powerful / flexible than L2TP.   Running multiple functions on the Hub MX obviously makes it work harder, so it's a matter of sizing:   use the Organization > Summary Report ftool or Security appliances to monitor load:   https://documentation.meraki.com/MX/Monitoring_and_Reporting/Device_Utilization

[PhilipDAth]

For 85 users - don't even think about using the Microsoft client.  You'll be buying yourself a support nightmare.

Stick with AnyConnect.  The most common configuration these days is SAML authentication directly against AzureAD (aka Office 365).  No servers required.

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/AnyConnect_Azure_AD_SA... 

Here is a list of other authentication options, including SAML options against things other than AzureAD:

https://documentation.meraki.com/MX/Client_VPN/AnyConnect_on_the_MX_Appliance/Authentication